Container Runtime Security Guide

# Dockerfile
FROM node:22-alpine

RUN addgroup -S app && adduser -S app -G app

WORKDIR /app
COPY --chown=app:app . .
RUN npm ci --omit=dev

USER app
CMD ["node", "server.js"]

# Kubernetes
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000

docker exec my-container whoami
# app (not root)

docker exec my-container id
# uid=1000(app) gid=1000(app)

# Kubernetes
securityContext:
  readOnlyRootFilesystem: true

volumeMounts:
  - name: tmp
    mountPath: /tmp
  - name: cache
    mountPath: /app/cache

volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir:
      sizeLimit: 100Mi

# Docker
docker run --read-only --tmpfs /tmp:rw,noexec,nosuid my-app

securityContext:
  capabilities:
    drop:
      - ALL           # Drop everything
    add:
      - NET_BIND_SERVICE  # Only add what's needed

securityContext:
  allowPrivilegeEscalation: false

# Kubernetes (1.19+)
securityContext:
  seccompProfile:
    type: RuntimeDefault  # Docker's default seccomp profile

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64"],
  "syscalls": [
    {
      "names": ["read", "write", "open", "close", "stat", "fstat", "mmap", "mprotect", "brk", "exit_group"],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: my-app:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      resources:
        limits:
          cpu: "1"
          memory: 512Mi
        requests:
          cpu: 200m
          memory: 256Mi
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir:
        sizeLimit: 50Mi

# Scan image
trivy image my-app:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL my-app:latest

# Scan in CI (fail on critical)
trivy image --exit-code 1 --severity CRITICAL my-app:latest

# Scan filesystem
trivy fs --security-checks vuln,secret .

# GitHub Actions
- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: my-app:${{ github.sha }}
    format: table
    exit-code: 1
    severity: CRITICAL,HIGH

# Pin specific versions
FROM node:22.12.0-alpine3.20

# Don't install unnecessary packages
RUN apk add --no-cache tini

# Remove package cache
RUN rm -rf /var/cache/apk/*

# Use .dockerignore
# Don't COPY secrets

# Use tini as PID 1
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "server.js"]

# NetworkPolicy: restrict egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-egress
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: postgres
      ports:
        - port: 5432
    - ports:
        - port: 53
          protocol: UDP